May 6 is World Password Day, created by Intel to promote good password hygiene! As you may already know, WCM recently updated its password policy to include a minimum of 16 characters to enhance the security of our users’ accounts. What you may not know is the reason why: we might already know your password.
- Cornell2020!
- COVID19NYP
- P@ssw0rd!
- Welcome2014!
- summer2020
- iloveyou
- Presbyterian@1047
- Nativenewyorker1!
In a recent security test, ITS was able to crack 41% of users’ accounts, using a seven-year-old computer, and came up with a massive list of passwords like the ones above. People tend to follow similar patterns of using a dictionary word, followed by numbers and punctuation. If you haven’t changed your WCM password yet, World Password Day is a great time to do it (especially if it resembles anything listed here)!
How to create an ironclad password
At a loss on how to create a strong password? Here’s how you can do it:
Forget passwords and focus on passphrases: A 16-character password may seem daunting, but it’s not if you come up with a passphrase. A passphrase is just a string of words that are memorable to you. The best passphrases are typically four random, unique, and unrelated words. Learn more about creating a passphrase!
Never share your password. This may seem obvious, but you’d be surprised how often people let their passwords slip. ITS will never ask for your password, and you shouldn’t have to reveal it to anyone in order to access your account. And don’t write it down anywhere!
Use a password manager. ITS provides free enterprise accounts for LastPass, a password manager that can help you manage your work and personal online accounts. You can have LastPass create various strong passwords for all of your accounts, but you only have to remember one master password to access everything. LastPass remembers your passwords for you and autofills fields when you’re logging into an account. You can visit our LastPass page on the ITS website, or watch our recent LastPass demonstration.
Add a layer of password protection with MFA. You’re probably used to using multi-factor authentication (MFA) with Duo, since it’s required to access multiple web-based services at WCM. However, you can also turn this option on for personal apps that you access, like your bank account. View the security options in your most commonly-used apps and turn on MFA, if it’s available. Once activated, you’ll typically get a text message from your app with a code confirming your identity whenever you sign in.